Elevator control system safety arrangement

ABSTRACT

A SAFETY ARRANGEMENT FOR AN ELEVATOR CONTROL SYSTEM WHICH PROVIDES SAFE OPERATION WHILE THE ELEVATOR CAR IS LOCATED AT A LANDING WITH ITS DOOR OPEN. A RELATIVELY LARGE ZONE EXTENDING ON BOTH SIDES OF EACH LANDING IS ESTABLISHED SO THAT THE ELEVATOR CAR AND HOISTWAY DOORS MAY START TO OPEN WHILE THE CAR IS LEVELING INTO REGISTRY WITH ANY LANDING AT WHICH IT IS STOPPING. THIS PERMITS THE DOORS TO BE OPEN A SUBSTANTIAL AMOUNT BY THE TIME THE CAR STOPS AT THE LANDING. A SMALLER ZONE EXTENDING ON BOTH SIDES OF EACH LANDING IS ALSO ESTABLISHED SO THAT UPON ENTERING THIS ZONE THE CAR IS THEREAFTER RESTRICTED IN ITS LEVELING OPERATION TO THIS SMALLER ZONE. FAILURE OF THE CAR ORIGINALLY TO ENTER THE SMALLER ZONE OR AFTER ENTRY TO REMAIN THEREIN AS LONG AS ITS DOORS ARE OPEN RESULTS IN THE CAR BEING PREVENTED FROM SUBSEQUENTLY MAKING A TRIP TO ANOTHER LANDING. IN ADDITION TO SAFEGUARDING AGAINST THIS AND OTHER MISOPERATIONS OF THE ELEVATOR CAR AND ITS CONTROL EQUIPMENT THIS SAFETY ARRANGEMENT ALSO MONITORS ITS OWN OPERATION TO PROTECT AGAINST THE SAFETY EQUIPMENT FAILING AND PRODUCING AN UNSAFE CONDITION.

United States Patent I 3,58'7,785

[72] Inventors Otto Albert Krauer Primary Examiner- Oris L. RaderTuckahoe; Assistant Examiner-W. E. Duncanson, Jr. Sheldon EdwinKornbluth, Brooklyn, N.Y. A!I0rneysJoseph L. Sharon and Robert T. Mayeri [2]] Appl. No. 804,242 r [22] Filed Mar. 4, I969 [45] Patented June28, 1971 ABSTRAQT: A safety arrangement for an elevator control [73]Assignee Otis Elevator Company system which provides safe operat onwhile the elevator car is New myy located at a landing with its doorsopen. A relatively large zone extending on both sides of each landing isestablished so that the elevator car and hoistway doors may start toopen while the car is leveling into registry with any landing at which[54] ELEVATOR CONTROL SYSTEM SAFETY it is stopping. This permits thedoors to be open a substantial ARRANGEMENT amount by the time the carstops at the landing. A smaller 23 Claims, 39mm 518$ zone extending onboth sides of each landing is also established so that upon enteringthis zone the car is thereafter [52] US. Cl l87/29R restricted in itsleveling operation to this smaller Zone Failure 5:5 of the caroriginally to enter the smaller zone or after entry to le 0 re remaintherein as long as its doors are open results in the car 3l8/456' 458'20070 20085; 317/13 being prevented from subsequently making a trip toanother I 5 6] Rekmm GM landing. In addition to safeguarding againstthis and other misoperations of the elevator car and its controlequipment this UNITED STATES PATENTS safety arrangement also monitorsits own operation to protect 2,867,292 1/1959 Bruns 187/29 against thesafety equipment failing and producing an unsafe 3,138,223 6/1964 Keiperet al. 187/29 diti I Y ELEVATOR CONTROL SYSTEM SAFETY ARRANGEMENT Thisis an invention in the elevator art. Specifically it concerns anarrangement for making an elevator car safe particularly while it islocated at a landing with its doors open.

Many features have been incorporated into elevator control systems overthe years to make them safer. One of the earliest to be adopted preventsmain operation of a car if either its car or one of its hoistway doorsis open. Good elevator service, however, demands that a car maintain itsregistry with a landing while it is located there with the doors open,notwithstanding changes in its load which stretch or contract its hoistropes. As a result, a leveling operation is provided which permitsmovement of the car toward a landing at reduced speed even though thedoors are open. This is used to restore the car to substantial registrywith a landing when necessary as well as to bring the car initially intosuch registry as it stops at a landing.

The need to provide the car some type of operation which enables it tomove with the doors open has pennitted some advantage to be taken ofthis to improve service by reducing traveling time. Thus, when a car isapproaching a landing at which it is stopping and after it has entered azone to which the leveling operation is restricted its door and thelanding hoistway door are permitted to open while the car is stillmoving. This enables the doors to be open a substantial amount as thecar comes to a stop and eliminates delay in transfer time which wouldotherwise occur in waiting for the doors to open.

The foregoing arrangement is standard on many present day elevators. Incase of a failure it permits the leveling equipment to move the car asubstantial distance, albeit at reduced speed, before either the doorsare forced to close or the car is stopped by its exit from the levelingzone.

It is an object of this invention to improve the safety of elevators.

It is another object of this invention to provide a safety arrangementfor an elevator control system.

It is a further object of this invention not only to permit an elevatorcar door and a hoistway door to open while the elevator is within apredetermined distance of a landing at which it is stopping, but also tolimit the movement of the car while it is thereafter located at thatlanding to a space within a smaller distance on either side of thelanding than the predetermined distance.

It is a further object of this invention to prevent an elevator car fromexceeding a predetermined speed with its car or one of its hoistwaydoors open.

It is a still further object of this invention to provide a safetyarrangement for an elevator control system which not only safeguards thesystem from misoperation but also monitors its own operation to insureits continued proper functioning.

ln carrying out the invention in a preferred embodiment there isprovided a control system for an elevator car, which is movablethroughout a building to serve a plurality of landings locatedtherethrough by starting from and stopping at selected ones of them, andwhich includes a plurality of hoistway doorway closures including atleast one door at each landing. The elevator car also has a doorwayclosure including at least one door. Both the car and the hoistway doorsare movable between opened and closed positions. As the car approachesfrom either direction within a specific distance of a selected landingat which a stop is to be made, a leveling position means, whichcomprises part of the car's landing selector machine and includes aswitching means common to all landings, operates to define a levelingzone which extends the specific distance on either side of the selectedlanding. Leveling control means including a distance controlled speeddictation signal generating device, which also comprises part of thelanding selector machine, operates in response to the operation oftheleveling position means. The leveling control means controls themovement of the car at a reduced speed in accordance with its distancefrom the selected landing during its approach through the leveling zoneto level the car to a stop in substantial registry with the selectedlanding. The leveling control means also operates to relevel the car andmaintain such registry after the car has stopped and it is enabled tocause both the leveling and releveling operations notwithstanding theopened positions of the car and hoistway doors.

Movement of the car through the leveling zone brings it within a secondpredetermined distance of the selected landing and an inner positionmeans, comprising part of the landing selector machine and includinganother switching means common to all landings, operates to define aninner zone which extends this second predetermined distance on eitherside of the landing. After the car enters the leveling zone and beforeit enters the inner zone, door control means is actuated to move thehoistway door or doors at the selected landing and the car door or doorsfrom their closed to their opened positions. Entry into the inner zonecauses the actuation of a safety means including a reliability circuitwhich thereafter limits the zone in which the leveling control means isenabled to control the movement of the car while it remains at theselected landing with the doors open to the inner zone.

In addition to the foregoing, outer position means is also provided.This too comprises part of the landing selector machine and includesanother switching means which is partially individual to each landingand partially common to all landings. It operates in response to thelocation of the car within a first predetermined distance on either sideof the selected landing farther therefrom than the second predetermineddistance. When operated it defines an outer zone for the selectedlanding. The operation of this outer position means actuates the doorcontrol means. The safety means operates in response to the operation ofboth the outer position means and the movement of the car and hoistwaydoors to their opened positions in conjunction with the failure of thecar to enter the inner zone to prevent the car from making a trip fromthe selected landing to another.

The safety means also operates to stop the car and to prevent it frommaking a trip from a selected landing should the car overspeed while atthe landing with its door or one of the hoistway doors open. To providethis protection the invention includes a speed responsive meanscomprising a tachometer generator and a switching means which respondsto a predetermined speed of the car. The safety means operates if thespeed responsive means indicates that the car is traveling at thispredetermined speed when either the car door or the hoistway door at theselected landing is in its opened position.

The speed responsive means is also employed to protect against amisoperation in which either the elevator car or its selector machinefunctions in a manner other than that intended for it such that theoperation of one is inconsistent with that of the other. The selectormachine includes both a synchronous panel which moves in synchronismwith the elevator car and an advancer carriage which moves in advance ofthe synchronous panel in a direction appropriate for the direction ofcar movement to select the next landing at which the car is to stop andto provide speed control signals to decelerate the car in accordancewith its distance from the selected landing. If when the car, in movingin a predetermined direction, reaches the predetermined speed at whichthe speed responsive means operates, the selector machine advancercarriage is not a prescribed distance away from the position of thesynchronous panel in the direction appropriate for the direction of carmovement, as indicated by the operation of the leveling position means,the safety means operates to stop the car and prevent it from making atrip to another landing.

Finally the safety means operates to stop the car and prevent it frommaking a trip from a selected landing should the car change itsacceleration too rapidly while its door or one of the hoistway doors isopen.

In addition to safeguarding the intended operation of the elevator car,the safety means also monitors itself to protect against failure of itsown equipment. Part of this self-monitoring operation includespreventing the car from making a trip from the selected landing toanother in case the inner position means fails to operate after theouter position means operates and the car and hoistway doors move totheir opened positions. Also the self-monitoring operation prevents thecar from making a trip to another landing if the outer position meansfails to operate and either the inner position means operates or thedoors move to their opened position. Moreover, the self-monitoringoperation prevents the car from making a trip to another landing if theouter position means operates to its unactuated condition before theinner position means operates to its unactuated condition.

The self-monitoring operation of the safety means also providesprotection against the failure of the tachometer generator to produce anoutput signal. To this end, a circuit is provided which stops the carand prevents it from making a trip from the selected landing to anotherif the tachometer generator is not producing an output signal when theleveling position means on the landing selector machine operates toindicate the entry of the car into the leveling zone at the selectedlanding.

Other objects, features and advantages of the invention will be apparentto those skilled in the elevator art from the following description andappended claims when considered in conjunction with the followingdrawing in which,

FIG. 1 is a schematic diagram of an elevator control system employingthe invention;

FIG. 2 is a wiring diagram in straight line form of relay circuitsemployed in the control system of FIG. 1; and

FIG. 3 is a plurality of comparator circuits in block diagram formtogether with associated relay coils and relay drive circuits.

Although it is adaptable to many elevator control systems, forsimplification purposes, the invention will be described as applied tothe elevator control system disclosed in the copending ELEVATOR CONTROLSYSTEM" application Ser. No. 495,585 of Otto Albert Krauer et al. filedOct. l3, 1965 now U.S. Pat. No. 3,442,352 and assigned to the assigneeof this application. It is to be realized, of course, that the systemdisclosed including the invention is simplified from that which would beused in a commercial installation and that in adapting the system tosuch an installation many changes might be made.

In the drawing the relays are shown with their coils in the deenergizedcondition. Consequently, all relay contact pairs are illustrated in whatis referred to as their unactuated condition. They are in the oppositeor their actuated condition when their associated coils are energized.The elevator system is illustrated as serving only three landingsalthough the invention is not so limited and may be used ininstallations with any number of landings.

Numerals in parentheses after the reference characters associated withsome of the connection lines in the drawing identify those FlGS. of thedrawing on which the continuations of such lines are to be found.

In the description hereinafter and in the appended claims the cardoorway closure will be referred to as a car door or as car door meansand each of the hoistway doorway closures will be referred to as ahoistway door or as hoistway door means, it being understood that bythis is meant any suitable type of car doorway closure and hoistwaydoorway closure whether of the single or plural door variety.

Referring to FIG. 1 of the drawing, traction sheave TS is mounted forrotation on the shaft of armature of the direct current elevatorhoisting motor. Also driven in any suitable way by the same shaft istachometer generator 34 which produces on line VT voltage signals whosemagnitudes are proportional to the speed of rotation of armature l0 andwhose polarities are indicative of the direction of such rotation.

In typical fashion hoist ropes 11 pass over sheave TS and supportelevator car CA and its counterweight CW. The car moves whenever brakeBR is lifted and the elevator hoisting motor enables sheave TS torotate. Main field 14 of the hoisting motor is connected across aconstant potential source represented as battery 15. In accordance withthe well-known Ward Leonard principles of variable voltage control.motor armature 10 is connected to ground across the output circuit of adirect current generator whose armature 16 is mounted on the same shaftas the rotating element 18 of a drive motor, not otherwise shown. Mainfield 20 of the direct current generator is connected through contacts C1-2 of potential switch C to receive excitation from operations andmotor control equipment OMCS. As is well understood, this equipment isalso connected through line W2 to receive distance controlled speeddictation signals from selector machine 42 during both main and levelingoperations. Tape TA connected between car CA and counterweight CWrotates sprocket SDS to drive the selector machine.

Sensing coils CDC and CCDC are wound on C-shaped cores which permit thewire conductor between generator armature l6 and motor armature 10 topass between the concave openings thereof. The material of these coresand the impedance of the coils and their connected circuitry are sochosen as to prevent the cores from saturating in response to a rate ofchange of acceleration with respect to time which is less than apredetermined amount.

In FIG. 2 lines L+ and L- are connected to a voltage source of suitablepotential to operate the relays whose coils are connected across theselines. Gate switch GS represents a typical switch operated in accordancewith the position of the car door means. Door switches IDS, ZDS and TDSrepresent typical switches operated in accordance with the position ofthe hoistway door means for the first, second and top landings,respectively. Each of the gate and door switches closes when itsrespective door means is approximately three-quarters of an inch fromits fully closed position and opens when its respective door means isopened more than this distance. Such switches are well known in the art.Gate switch GS and switches lDS, 2DS and TDS and door relay GDS comprisea portion of any typical door control means suitable to move the car andhoistway door means between their opened and closed positions. Thedotted line box identified by the reference characters DCC representsthe remainder of the door control means including a door operatingdevice. Such equipment comprising a closure means for the elevator car.

Outer zone brushes 10DB, 20DB and TODB are mounted on landing selectormachine 42 at positions corresponding to the location in the hoistway ofthe first, second and top landings, respectively. Outer zone contactsODC are also mounted on the selector machine 42. They are carried so asto move in synchronism with the elevator car and are bridged by one ofthe brushes 10DB, 20DB and TODB whenever the car is within a firstsuitable predetermined distance on either side of the landing associatedwith the respective bridging brush. Stated otherwise, contacts ODC arebridged by the brush 10DB, 20DB or TODB associated with a selectedlanding whenever the car is located within an outer zone at the selectedlanding which is defined by the space between two predetermined pointsone each within a suitable distance on either side of the selectedlanding. By a suitable distance is meant a sufficient distance to havethe car and hoistway doors open a satisfactory amount while the car isleveling to a stop at a landing. This, of course, varies frominstallation to installation according to various factors including thetype of door operating device and the weight and the size of the doors.

In the embodiment described and in the appended claims the outer zonewill be described as being inside the leveling zone. In most instancesthis will be the case. However, it is to be understood that it iscontemplated that the outer zone and the leveling zone might becoextensive.

Brushes 10DB, 20DB and TODB, contacts ODC and outer zone relay ODZtogether comprise that part of the invention referred to as outer carposition means or simply outer position means.

Contacts SPDSl correspond to those contacts identified by the samereference characters and shown in FIG. 10 of the foregoing Krauer et al.application. In the system of that application contacts SPDSI and asecond pair of contacts SPDS2 of mechanical switch SPDS on selectormachine 42 close and open, respectively, when the car approaches withinone to two feet of a landing at which it is stopping. In so operatingthese two contact pairs transfer control of the elevator hoisting motorfrom a long range distance controlled speed dictation signal generatingdevice including potentiometer POT operable to provide main operation toa short range one including potentiometer POTll operable to provideleveling operation. In this system contacts SPDS2 are eliminated andcontacts SPDS1 are employed to energize the coil of leveling zone relayHXB. Contacts SPDSl close when the car enters a leveling zone at aselected landing at which it is stopping; such leveling zone beingdefined by the space between two points one on either side of theselected landing and each within one to two feet thereof. Contacts HXB3-4 and HXB 5-6 (FIG. 1) of relay HXB are employed to perform thefunctions performed by contact pairs SPDSl and SPDS2 in the system ofthe foregoing Krauer et al. application. Switch SPDS, contact pair SPDSIand relay HXB comprise that part of the invention referred to as theleveling position means.

Contact pairs ADU and ADD are operated by mechanical switches mounted onselector machine 42 which operate in a manner similar to that of switchSPDS. Contacts ADU close when the advancer carriage is a specificdistance from the synchronous panel in a direction corresponding to upcar movement and contact ADD correspondingly operate for the downdirection car movement.

The dotted line box identified by the reference character S representsthe standard safety devices employed in the typical elevator controlsystem.

In FIG. 3 inner zone comparator IDZCOM operates to provide a signal torelay driver RDIDZ which is in conjunction with the potential along lineV3 is suitable to energize the coil of inner zone relay IDZ. Suchoperation occurs so long as the magnitude of the signal along eitherline V1+ or line V1 exceeds the magnitude of the signal of oppositepolarity along line VS from landing selector machine 42. In this way, aninner position means is provided which operates in response to thelocation of the car inside an inner zone at a selected landing at whichthe car is stopping; such inner zone being inside the leveling zone andbeing defined by the space between two additional predetermined pointsin the hoistway one on either side of the selected landing. In theembodiment described it is suitable to have each of these points within2 inches of a selected landing.

Like inner zone comparator IDZCOM maximum up and down speed comparatorsMZSUCOM and MZSDCOM operate to provide a signal to relay drivers RDMZSUand RDMZSD which in conjunction with the potential along line V3 issuitable to energize the coils of maximum up and down speed relays MZSUand MZSD. One of these is energized so long as the magnitude of thesignal along either line V2+ or line V2 exceeds the magnitude of thesignal of opposite polarity along line VT from tachometer generator 34.Should the magnitude of a signal of negative polarity along line VTexceed the magnitude of the positive signal along line V2+ or themagnitude of a signal of positive polarity along line VT exceed themagnitude of the negative signal along line V2-- the associated relayMZSU or MZSD releases. In this way, relays MZSU and MZSD operate toindicate that the speed of the car in the up and down directionsrespectively is below a predetermined magnitude.

Tachometer output comparator THOCOM operates to pro vide a signal torelay driver RDTHO which in conjunction with the potential along line V3is suitable to energize the coil of tachometer output relay THO wheneverthe magnitude of the output signal from tachometer generator 34 alongline VT exceeds the magnitude of the signal of opposite polarity alongline V4+ or V4-. Since the magnitudes of the signals along lines V4+ andV4 are selected at values only slightly in excess of the noise levelpotential of tachometer generator 34 the operation of relay THOindicates that the tachometer generator is producing an output signalgreater than its normal noise level. This is a suitable indication thatthe tachometer generator is operating satisfactorily.

Consider now the operation of the foregoing equipment in safeguardingthe elevator car and its control equipment against misoperation. Assumecar CA is traveling up approaching landing F2 at which it is stopping inaccordance with the description of either one of the stopping operationscontained in the foregoing Krauer et al. application. As the carapproaches within one to two feet of the landing, contact pair SPDSlcloses to energize the coil of relay HXB (FIG. 2). This closes contactsHXB 1-2 (FIG. 2) and contacts I-IXB 3-4 (FIG. 1) and opens contactsI-IXB 5-6 (FIG. 1). Contacts HXB 3-4 and HXB 5-6 in closing and openingrespectively transfer the system from main operation to levelingoperation. Contacts I-IXB 1-2 close to prepare circuits for door controlequipment DCC and the coil of outer zone relay ODZ.

Movement of the car under leveling operation brings it within a firstsuitable predetermined distance of landing F2 whereupon brush 20DBbridges contacts ODC. This energizes the coil of relay ODZ closingcontacts ODZ 7-8 ODZ 9-10 and ODZ 13-4 while at the same time openingcontacts ODZ 1-2 and ODZ 3-4. At the same time door control equipmentDCC is energized to open the door of car CA and the hoistway door atlanding F2. This opens car door contacts GS and hoistway door contacts2DS interrupting the circuit for the coil of door relay GDS. As aresult, contacts GDS 11-12 in one of the circuits for the coil of secondauxiliary potential relay CY2 open. This coil however remains energizedthrough the circuit including now closed contacts ODZ 9-10. Alsocontacts GDS 9-10 open in the coil circuit of first auxiliary potentialrelay CYl to release that relay. Contacts GDS 7-8 open in the coilcircuit of potential switch C that coil remaining energized through thecircuit of now closed contacts ODZ 7-8. Contacts GDS 1-2 close tomaintain a circuit for the coil of potential switch C after contacts CYl11-12 disengage. The elevator car is now leveling into landing F2 andboth the car door and the hoistway door for that landing are movingbetween their closed and opened positions.

Continued leveling of the car brings it to a point about 2 inches fromlanding F2. At this position the signal along line VS from selectormachine 42 is insufficient to overcome the potential along line V 1- andinner zone comparator IDZCOM (FIG. 3) operates to cause relay driverRDIDZ to produce a signal sufficient to energize the coil of inner zonerelay IDZ. This closes contacts IDZ 9-10 (FIG. 2) reenergizing the coilof first auxiliary potential relay CYI. Also contacts IDZ 7-8 engage inthe coil circuit of potential switch C. In addition, contacts IDZ 3-4disengage and interrupt the coil circuit for second auxiliary potentialrelay CY2. As a result, contacts CY2 13-14 open in the coil circuit ofpotential switch C. However, now closed contacts IDZ 7-8 maintain thiscircuit completed and the car continues leveling until it is within adesired distance of landing F2, usually within one-fourth inch thereof.

As can be seen, if the elevator car and its control equipment operate intheir intended manner the safety equipment has no effect upon thesystem. However, assume now that while the car remains located atlanding F2 with the doors open a misoperation occurs to cause it to movemore than 2 inches away from the landing. As a result, the signal alongline VS from selector machine 42 increases in magnitude sufficiently inone polarity or the other to overcome the potential along either lineVlor line Vl+ causing inner zone relay IDZ to release. This openscontacts IDZ 9-10 releasing first auxiliary potential relay CYl. Alsocontacts IDZ 7-8 open in the circuit for the coil of potential switch Cand this in conjunction with the release of relay CYI and the subsequentopening of contacts CYl 1 1-12 releases potential switch C. The releaseof switch C in typical fashion prevents the car from making a trip toanother landing such as by opening contact C 1-2 in the generator fieldcircuit (FIG. 1) and by opening additional contacts (not shown) torelease brake BR.

Thus, it can be seen that the present invention provides an arrangementwhich enables an elevator car to open its door and the hoistway door ofthe landing at which it is stopping while the car is leveling and afterit has entered a relatively large outer zone at the landing. However,once the car levels into a smaller inner zone it is thereafter preventedfrom leaving that inner zone as long as the doors remain open. In thisway, the leveling operation is restricted to this smaller inner zoneonce the car has entered it. Systems in which cars stop at landingswithout opening their doors similarly can be arranged to limit theleveling operation of their cars while located at such landings withtheir doors closed to the smaller inner zone.

Additionally, the car is prevented from making a trip to another landingif a misoperation prevents it from entering the smaller inner zone atany landing. Assume as before that the car has entered the leveling zoneat landing F2, has leveled into the outer zone and has started to openits door and the hoistway door at that landing. in these circumstances,door relay GDS is deenergized, relay CYl is deenergized, relay CY2 isenergized through contacts lDZ 3-4, ODZ 9-10 and CY2 11-12, andpotential switch C is energized through the circuit including contactsGDS l-2, CY2 13-14 and ODZ 7-8. If the car thereafter fails to enter theinner zone, inner zone relay lDZ remains deenergized and contacts lDZ7-8 and lDZ 9-10 remain open. As a result relay CY1 also remainsdeenergized and its contacts CYl 11-12 remain open. This in conjunctionwith the open condition of contacts lDZ 7-8 eliminates the parallelpaths for the coil of potential switch C which otherwise would beprovided through these contacts if the car and its control equipmentoperated in their intended manner.

Continued failure of the car to enter the inner zone and to cause theenergization ofinner zone relay lDZ indicates a misoperation. As aresult, the car is not permitted thereafter to make a trip from landingF2. If the doors try to close to enable the car to make such a trip,when they reach three-quarters of an inch from their fully closedpositions contacts GS and 2DS close to energize door relay GDS. Thisopens contacts GDS 1-2 and interrupts the circuit for the coil ofpotential switch C causing its deenergiza tion. Switch C releases and,as explained before, this prevents the car from making a subsequenttrip.

Under the foregoing condition, i.e. failure of the car to enter theinner zone, if the car should attempt to make a trip from landing F2without closing its door and the hoistway door at that landing, doorrelay GDS remains deenergized. This maintains contacts GDS 7-8separated. Movement of the advancer carriage from the position of thesynchronous panel sufficiently to open contacts SPDSl to release relayHXB and open contacts HXB 1-2 or movement of the car more than the firstpredetermined distance to separate brush DB from its bridgingrelationship with contact ODC interrupts the circuit for the coil ofouter, zone relay ODZ causing its deenergization. This releases relayODZ to open contacts ODZ 7-8 interrupting the circuit for the coil ofpotential switch C causing its deenergization. As previously describedswitch C releases to bring the car to a stop and prevent it from makinga subsequent trip.

As is evident from the foregoing the above described circuitry comprisesa safety means for an elevator control system. In addition it also.comprises a reliability circuit means which operates to provideprotection against failure of its own components. For example, it isapparent that if inner zone relay lDZ or its coils energizing circuitmisoperates and relay lDZ fails to transfer its contacts to theiractuated condition upon the car entering the inner zone, the circuitoperates to prevent the car from starting on a trip to another landingthe same as it does if relay [D2 is not operated because the car failsto enter the inner zone. Also, should inner zone relay [D2 or its coilsenergizing circuit misoperate and transfer its contacts from theiractuated to their unactuated condition while the car is in the innerzone the circuit operates to release potential switch C and prevent thecar from making a trip to another landing the same as it does if relaylDZ released because the car departed from the inner zone with its orthe hoistway door open.

Moreover, however, should inner door zone relay [D2 or its coilsenergizing circuit misoperate so that relay lDZ transfers its contactsfrom their unactuated to their actuated condition before the car entersthe outer door zone, contacts [02 l-2 open and interrupt the circuit forthe coil of potential switch C causing its deenergization. This, asdescribed previously, releases switch C bringing the car to a stop andpreventing it from making a subsequent trip. Should this misoperation ofthe inner zone relay or its coils energizing circuit occur after the carenters the outer zone, the car would come to a stop in its intendedmanner but in attempting to leave the landing thereafter contacts lDZl-2 would remain open to release potential switch C upon outer zonerelay ODZ releasing to open contacts ODZ 7-8. As previously explainedrelay ODZ releases upon the advancer carriage moving sufficiently fromthe position of the synchronous panel to open contacts SPDS1 and releaserelay HXB to open contacts HXB 1-2 or upon movement of the car more thanthe first predetermined distance from the landing to separate brush 20DBfrom its bridging relationship with contacts ODC.

The reliability circuit also provides protection against failures ofouter zone relay ODZ. Assume as before that the car has entered both theleveling zone and the outer zone at landing F2 and that for some reasonouter zone relay ODZ fails to transfer its contacts from theirunactuated to their actuated condition. As soon as the doors open beyondthreequarters of an inch from their fully closed positions door relayGDS releases to open contacts GDS 7-8. Because contacts ODZ 7-8 have notclosed this interrupts the circuit for the coil of potential switch Cand deenergizes it. Thus, switch C releases to stop the car and preventit from making a subsequent trip, as previously explained.

Similarly, if a misoperation occurs so that outer zone relay ODZtransfers its contacts from their actuated to their unactuated conditionafter the car enters the outer zone and after door relay GDS releases,contacts ODZ 7-8 open to release potential switch C with the sameresult.

A misoperation can also occur to cause door relay GDS to transfer itscontacts from their actuated to their unactuated condition when the caris outside the outer zone. If this occurs contacts GDS 7-8 open torelease potential switch C to stop the car and prevent it from making asubsequent trip.

As a further precaution against unsafe conditions the relays desirablefor use at least as door relay GDS, outer zone relay ODZ and inner zonerelay [D2 are of a type which cannot operate their contacts from onecondition to another if one of the contact pairs has welded.

Protection is also provided against the elevator car exceeding apredetermined speed with either its car or one of its hoistway doorsopen. If the speed is exceeded in the up direction the negative polarityvoltage from tachometer generator 34 along line VT is of sufficientmagnitude to exceed the positive polarity potential along line V2+ tocause the release of maximum speed up relay MZSU to open its contactsMZSU 1-2. If the predetermined speed is exceed in the down direction thepositive polarity voltage from tachometer generator 34 is of sufficientmagnitude to exceed the negative polarity potential along line V2 tocause the release of maximum speed down relay MZSD to open its contactsMZSD l-2. If any of the doors are in their opened position at the timecontacts MZSU 1-2 or MZSD 1-2 open, door relay GDS is released andcontacts GDS 13-14 are open. As a result, potential switch C releases tostop the car and prevent it from making a subsequent trip.

Since the output signal from tachometer generator 34 is used to provideprotection against overspeeding with the doors open it is desirable tomonitor the tachometer generator in order to safeguard against an unsafecondition resulting from its failure to produce an output signal. Thismonitoring is performed during each trip of the car. Every time the carreceives a signal to start from a landing on a trip to another,

tachometer monitoring relay T is energized if tachometer generator 34produced an output signal while the car was stopping at the landing fromwhich it is to start.

in order to understand this, assume that as the car was stopping andafter the engagement of contacts HXB 7-8 of leveling position relay HXB,the speed of the car was sufficient to produce an output signal fromtachometer generator 34 along line VT which overcame the signal ofopposite polarity along line V4+ or line V4. This caused theenergization of the coil of tachometer output relay THO and the closingof contacts THO l-2. Accordingly, the coil of tachometer monitoringrelay T was energized and contacts T 1-2 engaged. Thus notwithstandingthe output signal from tachometer generator 34 decreased below a valuesufficient to maintain relay THO operated when the car stopped, relay Tremained operated through its own contacts T 1-2 and contacts HXB 7-8.This maintains contacts T 3-4 engaged throughout the time the carremains at the landing from which it is starting so that the coil ofpotential switch C remains energized throughout this period.

As the selector advancer carriage moves from the position of thesynchronous panel in response to the signal to start contacts SPDSlseparate to release relay HXB. This closes contacts HXB 9-10 to maintainthe circuit for the coil of switch C and separates contacts HXB 7-8 tointerrupt the circuit for the coil of relay T. If after the car startson its trip from the landing tachometer generator 34 does not produce anoutput signal sufficient to cause the energization of relay THO,contacts THO 3-4 remain open in the coil circuit of switch C andcontacts THO 1-2 remain open in the coil circuit of relay T. With itscoil circuit interrupted relay T remains deenergized throughout the tripmaintaining contacts T 3-4 separated. Thus when the car approacheswithin 1 to 2 feet of the next selected landing at which it is to stopand contacts SPDSl engage to cause the energization of relay HXB, theconsequent opening of contacts HSB 9-10 interrupt the circuit for thecoil of potential switch C. This releases switch C and prevents the carfrom making a subsequent trip from the selected landing.

Just described is that part of the safety means by which equipmentoperated by landing selector machine 42, in particular contacts SPDSland the associated leveling position relay GXB are used to monitor theproper functioning of tachometer generator 34. In turn, the outputsignal produced by tachometer generator 34 is used to monitor the properfunctioning of landing selector 42. In this regard, if the speed of thecar has exceeded a predetermined magnitude in a par ticular directionthe advancer carriage must be a prescribed distance from the synchronouspanel in a direction associated with the particular direction in whichthe car is moving or else potential switch C is released to cause thecar to come to a stop and to prevent it from making a subsequent trip toanother landing.

For an explicit explanation of this, assume the car is traveling at afast enough speed in the up direction to cause the negative polarityoutput signal from tachometer generator 34 along line VT to exceed thepositive polarity signal along line V2+. This releases maximum up speedrelay MZSU and opens contacts MZSU 3-4. if as intended under normaloperating conditions, the selector machine advancer carriage is aprescribed distance away from the synchronous panel, mechanical switchcontacts ADU on selector machine 42 are closed. This maintains potentialswitch C energized so as not to interfere with the operation of the car.If when relay MZSU operates, however, the advancer carriage is not theprescribed distance away from the synchronous panel in the directionassociated with the up direction of movement of the car, contacts ADUare open and the circuit for the coil of potential switch C isinterrupted to release the switch. This, as previously explained, stopsthe car and prevents it from making a subsequent trip to anotherlanding.

Contacts MZSD 3-4 of maximum down speed relay MZSD and mechanical switchcontacts ADD on selector machine 42 operate in a similar fashion toprotect against inconsistent operation of the selector machine when thecar is traveling down.

Finally, protection is also provided against the elevator car changingits acceleration too rapidly with either its car or one of its hoistwaydoors open. If the rate of change of acceleration with respect to timeexceeds a predetermined amount one or the other of the sensing coils CDCor CCDC, depending upon the direction of current flow through thegenerator armature l6motor armature l0 circuit (FIG. 1), produces asignal of sufficiently positive potential to saturate transistor TDA.This causes the transistor to conduct which lowers its collectorpotential sufficiently to release relay DADT. This opens contacts DADTl-2 (FIG. 3) and if at this time either the car or one of the hoistwaydoors is open the circuit for the coil of potential switch C isinterrupted. As a result switch C releases stopping the car andpreventing it from making a trip to another landing.

Although contacts of the same relays MZSU and MZSD which are used toprotect against overspeeding with the doors open are used to monitor theproper operation of the selector machine in this description, it shouldbe understood that it is contemplated that it might be desirable tomonitor the proper operation of the selector machine by using contactsof a relay which is operable at a different speed than the relay whichis used to protect against overspeeding with the doors open.

Also, in the illustrated embodiment contacts of leveling position relayHXB are employed in the circuits that monitor the proper functioning oftachometer generator 34. Here too, it is contemplated either to usecontacts of a mechanical switch which operates directly in response tothe distance of the car from a selected landing other than contactsSPDSI or contacts of a relay which operates in response to the operationof this other mechanical switch.

Furthermore, it should also be understood that it is desirable toarrange the system so that after potential switch C has been released itcan only be restored to its actuated condition by qualified personnelworking in the equipment machine room. Such arrangements are well knownand for simplification purposes have not been described herein.

Various other modifications in the foregoing arrangement are possibleand it is intended that the invention not be limited to the particularlydescribed embodiment.

We claim:

1. A control system for an elevator car having a closure means andmovable to make trips to serve a plurality of landings by stopping atmost a desired distance from selected ones of said landings and byoperating its closure means upon so stopping to permit passengertransfers to and from the car, comprising; outer car position meansoperating from a first condition to a second condition in response tothe location of said car within a first predetermined distance on eitherside of a selected landing at which said car is stopping; inner earposition means operating from a first condition to a second condition inresponse to the location of said car within a second predetermineddistance on either side of said selected landing closer thereto thansaid first predetermined distance and farther therefrom than saiddesired distance; said first conditions of said outer and inner earposition means signifying the location of said car outside said firstand said second predetermined distances, respectively; said secondconditions of said outer and inner ear position means signifying thelocation of said car inside said first and second predetermineddistances, respectively; said outer and inner car position means beingtwo separate means each capable of operating independently of the other;and safety means operating in response to the operation of said outercar position means to said second condition and to the operation of saidclosure means to permit passenger transfers and to the failure of saidinner car position means to operate to said second condition preventingsaid car from making a trip from said selected landing to serve anotherlanding.

2. A control system according to claim 1, wherein, said safety meansalso operates to prevent said car from making a trip from said selectedlanding to serve another landing in response to the operation of saidinner ear position means to said second condition and the failure ofsaid outer car position means to operate to said second condition.

3. A control system for an elevator car movable to make trips to serve aplurality of landings by starting from and stopping at selected ones ofsaid landings, comprising; outer car position means operating inresponse to the location of said car inside an outer zone defined by thespace within a first predetermined distance on either side of a selectedlanding at which said car is stopping and signifying by said operationthe location of said car inside said outer zone; inner ear positionmeans operating in response to the location of said car inside an innerzone defined by the space within a second predetermined distance oneither side of said selected landing closer thereto than said firstpredetermined distance and signifying by said operation the location ofsaid car inside said inner zone; said outer and inner ear position meansbeing two separate means each capable of operating independently of theother; and safety means operating in response to the loca tion of saidcar inside said outer zone and the failure of said car to enter saidinner zone and preventing said car from making a trip from said selectedlanding to serve another landing; said safety means also operating inresponse to both the operation of said inner ear position means tosignify the location of said car within said inner zone and the failureof said outer car position means to operate to signify the location ofsaid car within said outer zone and preventing said car from making atrip from said selected landing to serve another landing.

4. A control system according to claim 3, wherein said safety means alsooperates to prevent said car from making a trip from said selectedlanding to serve another landing in response to the operation of saidouter car position means to signify the location of said car inside saidouter zone and the failure of said inner ear position means to operateto signify the location ofsaid car inside said inner zone.

5. A control system for an elevator car movable on trips throughout abuilding hoistway to provide service to a plurality of landings bystarting from and stopping at any selected ones of said landings,comprising; leveling position means operating in response to thelocation of said car inside a leveling zone at a selected landing atwhich said car is stopping, said leveling zone being defined by thespace between two predetermined points in said hoistway one on eitherside of said selected landing; inner position means operating inresponse to the location of said car inside an inner zone at saidselected landing, said inner zone being inside said leveling zone andbeing defined by the space between two other predetermined points insaid hoistway, one on either side of said selected landing; car doormeans on said car movable between a closed position and an openedposition; hoistway door means at each landing, each movable between aclosed position and an opened position; door control means operatingwhile said car is located inside the leveling zone at said selectedlanding and before it enters the associated inner zone and controllingsaid car door means and the hoistway door means at said selected landingto move from their closed positions to their opened positions; levelingcontrol means operating in response to the operation of said levelingposition means and controlling the movement of said car at a reducedspeed during its entire travel through said leveling zone to level saidcar to a stop in substantial registry with said selected landing and torelevel said car to maintain such registry after said car has stopped atsaid selected landing, said leveling and releveling operations beingenabled notwithstanding the opened positions of said car and hoistwaydoor means; and safety means operating in response to the operation ofsaid inner position means and limiting the zone in which said levelingcontrol means is effective to control the movement of said car while itremains at said selected landing with either of said door means in theopened position to said inner zone.

6. A control system according to claim 5, including outer position meansoperating in response to the location of said car inside an outer zoneat said selected landing, said outer zone being inside said levelingzone and surrounding said inner zone and being defined by the spacebetween two additional predetermined points in said hoistway, one oneither side of said selected landing; and wherein said safety meansoperates to prevent said car from making a trip from said selectedlanding to provide service to any other landing in response to both theoperation of said outer position means and the failure of said innerposition means to operate.

7. A control system according to claim 6, wherein said safety means alsooperates to prevent said car from making a trip from said selectedlanding to provide service to any other landing in response to both theoperation of said inner position means and the failure of said outerposition means to operate.

8. A control system according to claim 7, wherein said door controlmeans operates in response to the operation of said outer positionmeans.

9 A control system according to claim 8, wherein said inner positionmeans includes an inner zone relay having a plurality of contacts whichare transferred from an unactuated to an actuated condition in responseto the location of said car inside said inner zone; and said safetymeans includes circuitry comprising contacts of said inner zone relaythrough which said leveling control means is enabled to operate saidcircuitry being completed to enable the operation of said levelingcontrol means in response to the transfer of the contacts of said ihnerzone relay to their actuated condition.

10. A control system according to claim 9, wherein said door controlmeans includes a door relay having a plurality of contacts which aretransferred from an unactuated to an actuated condition in response tosaid car door means and all said hoistway door means being in theirclosed positions; said outer position means includes an outer zone relayhaving a plurality of contacts which are transferred from an unactuatedto an actuated condition in response to the location of said car insidesaid outer zone; and said safety means includes additional circuitrycomprising contacts of said inner zone relay, said door relay and saidouter zone relay through which said leveling control means is enabled tooperate, said additional circuitry being rendered ineffective to enablethe operation of said leveling control means upon the contacts of saidinner zone relay transferring to their actuated condition.

11. A control system according to claim 10, wherein all the circuitryconstituting said safety means forms a reliability circuit means whichmonitors the operation of said inner zone relay, said outer zone relayand said door relay to protect against failure of said relays producingan unsafe condition for said elevator car.

12. A control system according to claim ll, wherein said reliabilitycircuit means operates to prevent said elevator car from making a tripfrom said selected landing, firstly immediately if said inner zone relayfails and transfers its contacts from their actuated condition to theirunactuated condition when the car is located inside the inner zone, andsecondly, upon the car door means and the hoistway door means at saidselected landing moving to their closed positions, if said inner zonerelay fails, when said car is located inside said outer zone, andprevents its contacts from transferring from their unactuated conditionto their actuated condition in response to the entry of said car intosaid inner zone, and thirdly, immediately, if said inner zone relayfails and transfers its contacts from their unactuated condition totheir actuated condition when said car is located outside the outerzone, and fourthly, upon the departure of said car from the outer zone,if said inner zone relay fails when said car is located inside saidinner zone, and prevents its contacts from transferring from theiractuated condition to their unactuated condition in response to thedeparture of said car from said inner zone.

13. A control system according to claim 12, wherein said reliabilitycircuit means operates to prevent said elevator car from making a tripfrom said selected landing, firstly, immediately, if said outer zonerelay fails and transfers its contacts from their actuated to theirunactuated condition when said car is located inside the inner zone orwhen it is located inside the outer zone and said door relay contactsare in their unactuated condition, secondly, upon the car entering saidinner zone or upon said door relay contacts transferring to theirunactuated condition if said outer zone relay fails, either when the caris outside said outer zone, and prevents its contacts from transferringfrom their unactuated to their actuated condition when the car entersthe outer zone, or, when the car is located inside the outer zone, andtransfers its contacts from their actuated to their unactuated conditionbefore the car enters the inner zone or said door relay contactstransfer to their unactuated condition.

14. A control system according to claim 13, wherein said reliabilitycircuit means operates to prevent said elevator car from making a tripfrom said selected landing, firstly, immediately, if said door relayfails, when said car is located outside said outer zone, and transfersits contacts from their actuated condition to their unactuated conditionand secondly, upon said car departing from said outer zone if said doorrelay fails, when said car is located inside said outer zone, andprevents its contacts from transferring from their unactuated conditionto their actuated condition upon all doors reaching their closedpositions.

15. A control system according to claim 14, including speed responsivemeans operating in response to a predetermined speed of said car andwherein said safety means operates to stop said car if said speedresponsive means operates when said door relay contacts are in theirunactuated condition.

16. A control system-according to claim 15, including rate of change ofacceleration responsive means operating in response to a predeterminedrate of change of acceleration of said car with respect to time andwherein said safety means operates to stop said car if said rate ofchange of acceleration responsive means operates when said door relaycontacts are in their unactuated condition.

17. A control system for an elevator car movable on trips throughout abuilding hoistway to provide service to a plurality of landings bystarting from and stopping at any selected ones of said landings,comprising; car door means on said car movable between a closed positionand an opened position; hoistway door means at each landing, eachmovable between a closed position and an opened position; door controlmeans operating in response to the approach of said car to within apredetermined distance of a selected landing at which it is stopping andcontrolling said car door means and the hoistway door means at saidselected landing to move from their closed to their opened positions;speed responsive means operating in response to a predetermined speed ofsaid car; and safety means operating to prevent said car from making atrip from said selected landing if said speed responsive means operateswhen either said car door means or said hoistway door means at saidselected landing is in its opened position.

18. A control system according to claim 17 wherein said door controlmeans includes a door relay having a plurality of contacts which aretransferred from an unactuated to an actuated condition in response tosaid car door means and all said hoistway door means being in theirclosed positions; and said safety means operates if said speedresponsive means operates when said door relay contacts are in theirunactuated condition.

19. A control system according to claim 17, including car position meansoperating in response to the location of said car within a prescribeddistance on either side of a selected landing at which said car isstopping; wherein said speed responsive means includes a tachometergenerator operable to produce an output signal signifying the speed ofsaid car; and said safety means operates to prevent said car from makinga trip from said selected landing if said tachometer generator fails toproduce an output signal when said car position means operates.

20. A control system for an elevator car movable on trips throu bout abuilding hoistway to provide service to a plurality of andlngs bystarting and stopping at any selected ones of said landings, comprising;speed responsive means operating in response to a predetermined speed ofsaid car in a predetermined direction of travel and signifying saidspeed and direction; a landing selector machine including a synchronouspart operable to signifymovement in synchronism with the movement ofsaid car and an advancer part operable to signify movement in advance ofthe movement of said car in a direction appropriate for the direction ofcar movement; advancer position means operating in response to thesignified location of said advancer part a prescribed distance away fromthe signified location of said synchonous part in a directionappropriate for said predetermined direction; and safety means operatingto prevent said car from making a trip to another landing if said speedresponsive means operates to signify the predetermined speed for saidcar in the predetermined direction and the advancer position means hasfailed to operate.

21. A control system for an elevator car movable on trips throughout abuilding hoistway to provide service to a plurality of landings bystarting from and stopping at any selected ones of said landings,comprising; rate of change of acceleration responsive means operating inresponse to a predetermined rate of change of acceleration of said carwith respect to time; and safety means operating in response to theoperation of said rate of change of acceleration responsive means tostop said car and to prevent it from making a trip to another landing22. A control system according to claim 21, further comprising; car doormeans on said car movable between a closed position and an openedposition; hoistway door means at each landing, each movable between aclosed position and an opened position; door control means operating inresponse to the approach of said car to within a predetermined distanceof a selected landing at which it is stopping and controlling said cardoor means and the hoistway door means at said selected landing to movefrom their closed to their opened positions and wherein said safetymeans operates in response to the operation of said rate of change ofacceleration responsive means to stop said car and to prevent it frommaking a trip from said selected landing if said rate of change ofacceleration responsive means operates when either said car door meansor said hoistway door means at said selected landing is in its openedposition.

23. A control system according to claim 22 wherein said door controlmeans includes a door relay having a plurality of contacts which aretransferred from an unactuated to an actuated condition in response tosaid car door means and all said hoistway door means being in theirclosed positions; and said safety means operates if said rate of changeof acceleration responsive means operates when said door relay contactsare in their unactuated condition.

